diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index b7ca057a6f..1e1b2862e4 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -1,5 +1,18 @@
 # Compatibility Contract
 
+## Server v1.6.564 source candidate
+
+Not yet published. Installation examples remain on published Server563.
+The candidate consumes original published Engine365 / Web204. Optional bridge
+0.2.6 shares the Web producer and is not a second Server runtime. Exact private
+volume/pool cleanup, safe native validation status/code and Catalog wire
+compatibility are corrected. Web admission guidance retains submitted-apply
+UNKNOWN/context/ACK protection. Current actor/role/Key/revision, explicit DENY,
+human confirmation and CAS remain required. Other pins, VEX statements and
+vendor decisions are retained. Matching Server/native acceptance is pending.
+See [candidate coordinates](docs/releases/server-1.6.564.md).
+
+
 <a id="server-v16563-publication"></a>
 
 ## Server v1.6.563 published
diff --git a/docs/releases/server-1.6.564.md b/docs/releases/server-1.6.564.md
new file mode 100644
index 0000000000..868803612b
--- /dev/null
+++ b/docs/releases/server-1.6.564.md
@@ -0,0 +1,36 @@
+# Server v1.6.564 candidate
+
+Source candidate; not a published image. Installation remains on published563.
+Matching Server publication/restart/business acceptance is pending.
+
+Engine365 corrects the verified standalone private OS-volume/pool cleanup graph,
+safe native validation status/code propagation and bounded single-Base64 Catalog
+private wire. Owner, live role/Key/revision, explicit DENY, exact target binding,
+verified execution lineage and terminal references remain required. Member
+cleanup authorization is substantive; Catalog wire adds no relaxation. Foreign
+Alias references retain native422/InvalidReference, without native detail.
+Web204 provides fixed safe browser/stdio admission guidance while preserving
+context replacement, unverified ACK and submitted-apply UNKNOWN protections.
+Prior Web203 restricted-Key/human-review/footer layout behavior is inherited.
+
+## Verified component inputs
+
+- Engine v0.183.365: producer 10e674d32de9c5d6ad63867a1b76d080ac76af48; tag 259ef59e8110fab71488d5dbd8c9affda4279217; tree e059d0a55c8ae20e3465a5e27c58a56bbcb892b4.
+- cattle.jar SHA256 46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047 (88237445 bytes); SBOM 01d2fd79b93c7fd1b5ea72da9247b0fca483c6e5f757918d250e2d3347b5e02c.
+- Original Security 41295587271 attempt 1; CodeQL 41295587190 / 41295591698; 3891 tests in 418 suites, zero failure/error, 1 existing skips.
+- Exactly19 new methods: volume/pool13, Domain1, PlanService1, private-wire4;76 original required methods retained for95 total. Focused22 is not19 new methods. Wire-mock18 and prior Image6/External8/preview7/Index8 remain inherited.
+- C03: 432 inputs / 1396 HTTP tuples / 1397 rows; source fingerprint fdf53022efdab0e56edb292da037216be051643770565c090424124be8b115ea. HTTP classification delta0; substantive Member cleanup delta retained.
+- Five packaged role schemas unchanged from364. JDBC3.5.11 SHA256 42604178b9e57ec08ee0035079961516f086e455d0141f0b22c6eff29fb2fff4; all four reported CVEs absent in original artifact/SBOM/raw scans including ignored entries.89 version-only POMs; runtime dependency coordinates unchanged.
+- Web 1.6.204 / bridge 0.2.6: producer 64caa55d0b0768de1633549b54a169ddb62c9194; tag da24369ea12455d38f7dc63aef906eed5e38ffea; tree 6e76dbe42f665335df51ccc8ee2852be4fcdda8d.
+- Web archive 8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e; lock bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32; runtime SBOM 195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa.
+- Web original CI: 1122 Ember /0fail;5 new source cases (browser4/bridge-core1),22 inherited203;35 collaboration and1 QUnit/96 parameter combinations. These are not new business groups.
+- Bridge026 ZIP 091379b24f6651d54d49e463be5fa4d4bb60dae1551d857251ad06de5ea37f63. Fresh exact026 source/SBOM; unchanged025 dependency/install/SDK evidence carried, no new026 handshake claim. No extra Server runtime bridge.
+- All12 Engine and13 Web assets passed actual anonymous SHA/length readback against exact public metadata. Web archive provenance and runtime-SBOM attestations passed. No native Engine SLSA attestation is inferred.
+
+Catalog0.20.17 / Compose0.14.40 and other pins/base image, VEX statements and
+vendor decisions remain unchanged. Source preparation rebuilds no component.
+The original Server publisher must pass its source/build/restart/merged-image
+and browser scans/native attestation gates. Core, External/Alias, Member,
+Catalog, roles/Keys/cross-ID, cleanup and weak-model runtime remain pending.
+Four AI opt-ins remain independently default-off. Server563 results do not
+become Server564 PASS. Full243 coverage is incomplete.
diff --git a/scripts/check-server-api-explorer-patch.sh b/scripts/check-server-api-explorer-patch.sh
index 6b9a636757..3b4fdf1f94 100755
--- a/scripts/check-server-api-explorer-patch.sh
+++ b/scripts/check-server-api-explorer-patch.sh
@@ -533,7 +533,7 @@ require_marker "$release_dockerfile" \
     SERVER_INCREMENTAL_RELEASE_BASE_MISSING
 for web_sbom_release_marker in \
     'COPY --chmod=0755 artifacts/verify-web-console-sbom.py /usr/local/bin/verify-web-console-sbom' \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.203-runtime.cdx.json' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.204-runtime.cdx.json' \
     '"${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT}" "${WEB_CONSOLE_RUNTIME_SBOM_SHA256}" "${web_sbom}";' \
     '--lock-sha256 "${WEB_CONSOLE_LOCK_SHA256}" --archive "${web_archive}"' \
     '--webmcp-ceiling enabled;' \
@@ -571,7 +571,7 @@ python3 scripts/test-web-console-sbom.py
 python3 server/security/test_web_console_sbom_scan.py
 
 require_marker "$release_dockerfile" \
-    'ARG SERVER_RELEASE_TAG=v1.6.563' \
+    'ARG SERVER_RELEASE_TAG=v1.6.564' \
     SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING
 require_marker "$release_dockerfile" \
     'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"' \
@@ -629,22 +629,22 @@ require_marker "$publish_workflow" \
     'bash source/server/artifacts/verify-host-api-package.sh' \
     SERVER_HOST_API_PRODUCER_RELEASE_CHECK_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.203' \
+    'ARG WEB_CONSOLE_RELEASE_TAG=1.6.204' \
     SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.203.tar.gz' \
+    'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_ARTIFACT_SHA256=81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d' \
+    'ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e' \
     SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_COMMIT=d97a8990801a281b519573a48b0db7dd12c9a616' \
+    'ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194' \
     SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_LOCK_SHA256=a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452' \
+    'ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32' \
     SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING
 require_marker "$release_dockerfile" \
-    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e' \
+    'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa' \
     SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     "grep -aF 'hostsPage.permissionDenied'" \
@@ -653,22 +653,22 @@ require_marker "$release_dockerfile" \
     '"hostsPage.permissionDenied":"您沒有權限在此環境中新增主機。"' \
     SERVER_INCREMENTAL_WEB_CONSOLE_ZH_TW_PERMISSION_MESSAGE_MISSING
 require_marker "$build_script" \
-    'web_console_commit=${WEB_CONSOLE_COMMIT:-d97a8990801a281b519573a48b0db7dd12c9a616}' \
+    'web_console_commit=${WEB_CONSOLE_COMMIT:-64caa55d0b0768de1633549b54a169ddb62c9194}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING
 require_marker "$build_script" \
-    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.203}' \
+    'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.203.tar.gz}' \
+    'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING
 require_marker "$build_script" \
-    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d}' \
+    'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452}' \
+    'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING
 require_marker "$build_script" \
-    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e}' \
+    'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa}' \
     SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING
 require_marker "$release_dockerfile" \
     'ARG CATALOG_SERVICE_VERSION=0.20.17' \
@@ -1139,21 +1139,21 @@ require_marker "$build_script" \
     '--file server/Dockerfile.web-compose-release' \
     SERVER_INCREMENTAL_RELEASE_BUILD_PATH_MISSING
 require_marker "$build_script" \
-    'image=${IMAGE:-pasturestack-validation/server:v1.6.563}' \
+    'image=${IMAGE:-pasturestack-validation/server:v1.6.564}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING
 require_marker "$build_script" \
-    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.563}' \
+    'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564}' \
     SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING
 require_marker "$build_script" \
     'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"' \
     SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING
 for release_engine_marker in \
-    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.364' \
+    'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365' \
     'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar' \
-    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb' \
-    'ARG ORCHESTRATION_ENGINE_COMMIT=e780d1613ab2a14112ba9e14fa55754b4e16ed0b' \
+    'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047' \
+    'ARG ORCHESTRATION_ENGINE_COMMIT=10e674d32de9c5d6ad63867a1b76d080ac76af48' \
     'COPY --from=release_artifacts /out/orchestration-engine.jar /tmp/orchestration-engine.jar' \
-    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.364' \
+    'ARG ORCHESTRATION_ENGINE_VERSION=0.183.365' \
     'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar' \
@@ -1172,10 +1172,10 @@ for release_engine_marker in \
         SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING
 done
 for release_engine_build_marker in \
-    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}' \
+    'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}' \
     'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}' \
-    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb}' \
-    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e780d1613ab2a14112ba9e14fa55754b4e16ed0b}' \
+    'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047}' \
+    'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-10e674d32de9c5d6ad63867a1b76d080ac76af48}' \
     'CATTLE_CATTLE_VERSION="${orchestration_engine_release_tag}"' \
     'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar' \
     '< "${server_dir}/artifacts/verify-engine-archive.sh"'; do
@@ -1694,10 +1694,10 @@ fi
 if grep -Fxq '## Current source candidate' README.md; then
     for candidate_readme_marker in \
         '<a id="current-release"></a>' \
-        'Server `v1.6.563` is a prepared source candidate, not a published image.' \
+        'Server `v1.6.564` is a prepared source candidate, not a published image.' \
         'run them only after its official release' \
         'This candidate is not yet available' \
-        'ghcr.io/pasturestack/server:v1.6.563'; do
+        'ghcr.io/pasturestack/server:v1.6.564'; do
         require_marker README.md "$candidate_readme_marker" \
             SERVER_CURRENT_CANDIDATE_README_MISSING
     done
@@ -2303,7 +2303,7 @@ done
 jq -e '
   ["CVE-2026-107928","CVE-2026-107929","CVE-2026-86409","CVE-2026-86410","CVE-2026-86412","CVE-2026-86414","CVE-2026-87862","CVE-2026-87863","CVE-2026-87864","CVE-2026-87865","CVE-2026-92386","CVE-2026-92387","CVE-2026-92388","CVE-2026-92389","CVE-2026-92390","CVE-2026-92391","CVE-2026-92392","CVE-2026-94266"] as $curl_fixed_cves
   |   .["@context"] == "https://openvex.dev/ns/v0.2.0"
-  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.563"
+  and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564"
   and (.statements | length) == 56
   and ([.statements[].vulnerability.name] | length == (unique | length))
   and ([.statements[] | select(.status == "fixed") | .vulnerability.name] | sort)
@@ -2341,7 +2341,7 @@ jq -r '
   | @tsv
 ' "$runtime_vendor_pending" | LC_ALL=C sort -u >"$vendor_pending_fixture"
 bash "$vendor_pending_validator" "$runtime_vendor_pending" \
-    "$vendor_pending_fixture" v1.6.563 >/dev/null
+    "$vendor_pending_fixture" v1.6.564 >/dev/null
 bash scripts/test-vendor-pending-findings.sh >/dev/null
 rm -f "$vendor_pending_fixture"
 trap - EXIT
@@ -2430,4 +2430,4 @@ for release_readback_contract in \
     fi
 done
 
-printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.563 base=v1.6.460 engine=0.183.364 web_console=1.6.203 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
+printf 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 webhook_automation_service=0.10.5 authentication_service=0.4.46 curl=8.18.0-1ubuntu2.8 freemarker=2.3.35 artifact_scan=required vendor_pending=exact-set role_matrix=qa-required locale_layout=qa-required\n'
diff --git a/scripts/test-current-server-packaging-contract.py b/scripts/test-current-server-packaging-contract.py
index a4f8dac9ce..3ab65f4183 100644
--- a/scripts/test-current-server-packaging-contract.py
+++ b/scripts/test-current-server-packaging-contract.py
@@ -34,16 +34,16 @@
 PUBLISHED_508 = 'Server `v1.6.508` 已正式發布，封裝 Web Console `1.6.171`。'
 STALE_508_CANDIDATE = 'Server `v1.6.508` candidate packages Web Console `1.6.171`'
 COMPATIBILITY_CODE = 'SERVER_CREATE_RESPONSE_ORDER_COMPATIBILITY_MISSING'
-WEB_SHA = '81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d'
-WEB_SOURCE = 'd97a8990801a281b519573a48b0db7dd12c9a616'
-WEB_SBOM_SHA = 'a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e'
-WEB_LOCK_SHA = 'a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452'
+WEB_SHA = '8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e'
+WEB_SOURCE = '64caa55d0b0768de1633549b54a169ddb62c9194'
+WEB_SBOM_SHA = '195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa'
+WEB_LOCK_SHA = 'bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32'
 CATALOG_COMMIT = '00eec89e5fdeb9728c1c41babccad8b7dfc8b297'
-ENGINE_SHA = '279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb'
-ENGINE_SOURCE = 'e780d1613ab2a14112ba9e14fa55754b4e16ed0b'
+ENGINE_SHA = '46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047'
+ENGINE_SOURCE = '10e674d32de9c5d6ad63867a1b76d080ac76af48'
 OLD_COORDINATES = {
-    'v1.6.563': 'v1.6.521',
-    '1.6.203': '1.6.181',
+    'v1.6.564': 'v1.6.521',
+    '1.6.204': '1.6.181',
     WEB_SHA: '9199681f2c4311f3fbe8727fcf0f6fa136c9bafe9fbe9d13878c55df442a7a03',
     WEB_SOURCE: '7f2bdad0c90a3241693c2ddd4475202ababba550',
     CATALOG_COMMIT: '7670ffd81d5f0b5570197fb03c7e55b46da45bf3',
@@ -60,29 +60,29 @@
     ('LICENSE_SHA256', 'license_sha256', '0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594'),
 )
 LEGACY_ENGINE_COORDINATES = {
-    '0.183.364': '0.183.337',
+    '0.183.365': '0.183.337',
     ENGINE_SHA: '7e45189f2b57097efc7929c04ddf7767aebbe027d1b9f90023aa6711522c5c80',
     ENGINE_SOURCE: 'ba041fe312dfe97fc1e5144af576ddcf1b573d8e',
 }
 EXPECTED = {
     COMPATIBILITY_CODE: (COMPATIBILITY, PUBLISHED_508),
-    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.563'),
+    'SERVER_INCREMENTAL_RELEASE_DEFAULT_MISSING': (DOCKER, 'ARG SERVER_RELEASE_TAG=v1.6.564'),
     'SERVER_INCREMENTAL_RELEASE_VERSION_MISSING': (DOCKER, 'org.opencontainers.image.version="${SERVER_RELEASE_TAG}"'),
     'SERVER_INCREMENTAL_RELEASE_RUNTIME_VERSION_MISSING': (DOCKER, 'ENV CATTLE_RANCHER_SERVER_VERSION=${SERVER_RELEASE_TAG}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.203'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.203.tar.gz'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_VERSION_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RELEASE_TAG=1.6.204'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_ARTIFACT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_ARTIFACT_SHA256=' + WEB_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_COMMIT_MISSING': (DOCKER, 'ARG WEB_CONSOLE_COMMIT=' + WEB_SOURCE),
     'SERVER_INCREMENTAL_WEB_CONSOLE_LOCK_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_LOCK_SHA256=' + WEB_LOCK_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_SBOM_HASH_MISSING': (DOCKER, 'ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=' + WEB_SBOM_SHA),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_COMMIT_MISSING': (BUILD, 'web_console_commit=${WEB_CONSOLE_COMMIT:-' + WEB_SOURCE + '}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.203}'),
-    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.203.tar.gz}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_VERSION_MISSING': (BUILD, 'web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}'),
+    'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_ARTIFACT_MISSING': (BUILD, 'web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_HASH_MISSING': (BUILD, 'web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-' + WEB_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_LOCK_HASH_MISSING': (BUILD, 'web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-' + WEB_LOCK_SHA + '}'),
     'SERVER_INCREMENTAL_WEB_CONSOLE_BUILD_SBOM_HASH_MISSING': (BUILD, 'web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-' + WEB_SBOM_SHA + '}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.563}'),
-    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.563}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_VERSION_MISSING': (BUILD, 'image=${IMAGE:-pasturestack-validation/server:v1.6.564}'),
+    'SERVER_INCREMENTAL_RELEASE_BUILD_DEFAULT_MISSING': (BUILD, 'server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564}'),
     'SERVER_INCREMENTAL_RELEASE_BUILD_RUNTIME_VERSION_MISSING': (BUILD, 'CATTLE_RANCHER_SERVER_VERSION="${server_release_tag}"'),
     'SERVER_WEB_CONSOLE_RUNTIME_VERSION_GATE_MISSING': (BUILD, 'test "$(cat "${web_root}/VERSION.txt")" = "${WEB_CONSOLE_RELEASE_TAG}"'),
     'SERVER_VOLUME_NATIVE_READ_ONLY_BUILD_GATE_MISSING': (DOCKER, 'grep -F \'"volume.isNative" : "r"\' >/dev/null'),
@@ -103,18 +103,18 @@
 CREATE_RESPONSE_CODES = ['SERVER_WEB_CREATE_IDENTITY_BUILD_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_BUILD_GATE_MISSING','SERVER_WEB_CREATE_IDENTITY_RUNTIME_GATE_MISSING','SERVER_WEB_CANONICAL_RECORD_RUNTIME_GATE_MISSING']
 ENGINE_EXPECTED = {
     'SERVER_INCREMENTAL_ENGINE_REPLACEMENT_MISSING': (DOCKER, 'release_engine_marker', (
-        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.364',
+        'ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar',
         'ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=' + ENGINE_SHA,
         'ARG ORCHESTRATION_ENGINE_COMMIT=' + ENGINE_SOURCE,
-        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.364',
+        'ARG ORCHESTRATION_ENGINE_VERSION=0.183.365',
         'sh /usr/share/cattle/verify-engine-archive.sh "${archive}" "${ORCHESTRATION_ENGINE_VERSION}" "${ORCHESTRATION_ENGINE_ARTIFACT_SHA256}"',
         'cattle-resources-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'cattle-app-config-${ORCHESTRATION_ENGINE_VERSION}.jar',
         'ENV CATTLE_CATTLE_VERSION=${ORCHESTRATION_ENGINE_RELEASE_TAG}',
     )),
     'SERVER_INCREMENTAL_ENGINE_BUILD_COORDINATE_MISSING': (BUILD, 'release_engine_build_marker', (
-        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}',
+        'orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}',
         'orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}',
         'orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-' + ENGINE_SHA + '}',
         'orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-' + ENGINE_SOURCE + '}',
@@ -608,15 +608,15 @@ def verify(files, gate=GATE):
                 pipeline = r'(?:^|[;\n])\s*' + re.escape(marker) + r'(?=\s*(?:;|\n|$))'
                 if len(re.findall(pipeline, source)) != 1:
                     raise AssertionError('CURRENT_CATALOG_HASH_BYPASS')
-    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.563"' not in gate:
+    if 'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564"' not in gate:
         raise AssertionError('CURRENT_VEX_GATE_PIN_MISMATCH')
-    if '"$vendor_pending_fixture" v1.6.563 >/dev/null' not in gate:
+    if '"$vendor_pending_fixture" v1.6.564 >/dev/null' not in gate:
         raise AssertionError('CURRENT_VENDOR_GATE_PIN_MISMATCH')
-    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.563':
+    if json.loads(files[VEX]).get('@id') != 'https://github.com/PastureStack/server/security/openvex/v1.6.564':
         raise AssertionError('CURRENT_VEX_RELEASE_MISMATCH')
-    if json.loads(files[VENDOR]).get('release') != 'v1.6.563':
+    if json.loads(files[VENDOR]).get('release') != 'v1.6.564':
         raise AssertionError('CURRENT_VENDOR_RELEASE_MISMATCH')
-    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.563 base=v1.6.460 engine=0.183.364 web_console=1.6.203 catalog_service=0.20.17 ' not in gate:
+    if 'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 ' not in gate:
         raise AssertionError('CURRENT_SUMMARY_MISMATCH')
     verify_incremental_contract(files, gate)
     verify_load_balancer_contract(files, gate)
@@ -631,11 +631,11 @@ def previous_gate(gate=GATE):
         if stale(marker) != marker:
             replacements["'" + marker + "' "] = "'" + stale(marker) + "' "
     replacements.update({
-        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.563"':
+        'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.564"':
             'and .["@id"] == "https://github.com/PastureStack/server/security/openvex/v1.6.521"',
-        '"$vendor_pending_fixture" v1.6.563 >/dev/null':
+        '"$vendor_pending_fixture" v1.6.564 >/dev/null':
             '"$vendor_pending_fixture" v1.6.521 >/dev/null',
-        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.563 base=v1.6.460 engine=0.183.364 web_console=1.6.203 catalog_service=0.20.17 ':
+        'SERVER_API_EXPLORER_PATCH_OK release=v1.6.564 base=v1.6.460 engine=0.183.365 web_console=1.6.204 catalog_service=0.20.17 ':
             'SERVER_API_EXPLORER_PATCH_OK release=v1.6.521 base=v1.6.460 engine=0.183.340 web_console=1.6.181 catalog_service=0.20.12 ',
     })
     for marker, stale_marker in replacements.items():
@@ -1299,7 +1299,7 @@ def test_each_old_engine_coordinate_rejected(self):
         self.assertGreater(checked, 0)
 
     def test_historical_engine340_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.340',
+        old = {'0.183.365': '0.183.340',
                ENGINE_SHA: '5e5a1b908b43bf3824fc3bb2108bd661cd5199ce9bcfd187e0b18b5608a38cea',
                ENGINE_SOURCE: 'ff0a41e7676211043eb4f755a306a9e2a19abee1'}
         checked = 0
@@ -1320,13 +1320,13 @@ def test_historical_engine340_cannot_be_packaged(self):
 
     def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
         candidate = (REPO / 'server/build-component-candidate.sh').read_text(encoding='utf-8')
-        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.563}', candidate)
-        self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}', candidate)
+        self.assertIn('export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.564}', candidate)
+        self.assertIn('export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}', candidate)
         for old in (
-            {'0.183.364': '0.183.351',
+            {'0.183.365': '0.183.351',
              ENGINE_SHA: 'efd0e826364c551f782b281f081d53cadb48faa7d5c37c2f101e6f9c7d7f9ea6',
              ENGINE_SOURCE: '1befd83278618f9a5b7cdaf96522004dd89918ba'},
-            {'0.183.364': '0.183.350',
+            {'0.183.365': '0.183.350',
              ENGINE_SHA: '637ddaa42cd93c019b4d0813d7053b71dc42797a7f3ac2aa4b10fcc7e304cb31',
              ENGINE_SOURCE: '9c884710e5ea3d4136d80a870d9de9485674f3c3'},
             {ENGINE_SOURCE: '109f2623f00ca3a3a9079414a0f0f8bd23cd1eb2'},
@@ -1349,7 +1349,7 @@ def test_engine352_actual_war_producer_and_previous351_350_boundary(self):
 
 
     def test_immediately_previous_engine341_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.341',
+        old = {'0.183.365': '0.183.341',
                ENGINE_SHA: '3ede1ad28b7a7e0754c4c953bd486162f7ffe0b2f76ce384ec485632af6b8e6d',
                ENGINE_SOURCE: 'b245cf778479445ded0786d3898b03fea153212e'}
         checked = 0
@@ -1370,7 +1370,7 @@ def test_immediately_previous_engine341_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine342_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.342',
+        old = {'0.183.365': '0.183.342',
                ENGINE_SHA: '3533f247392795329c92516a7966510aafbe81a52e3f922e5ec657a2071363b5',
                ENGINE_SOURCE: 'ddae4bb8e12806f70816f5782cd999eccd0f2ce6'}
         checked = 0
@@ -1391,7 +1391,7 @@ def test_immediately_previous_engine342_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine343_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.343',
+        old = {'0.183.365': '0.183.343',
                ENGINE_SHA: 'b29c0057f96dbae38bfe2c663c63bbe4c8b5c755b3090f39414aa51f9813025f',
                ENGINE_SOURCE: '5aa9d8978c75a7fe63330453c399a92716d88568'}
         checked = 0
@@ -1412,7 +1412,7 @@ def test_immediately_previous_engine343_cannot_be_packaged(self):
 
 
     def test_immediately_previous_engine344_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.344',
+        old = {'0.183.365': '0.183.344',
                ENGINE_SHA: 'ffafa4700156b74ec11bcae1b830738e49943f1a3b8b0565895ed6d7726eebf1',
                ENGINE_SOURCE: '72c42e6f2000301fe03ffd2442fb9ee89aee120c'}
         checked = 0
@@ -1432,7 +1432,7 @@ def test_immediately_previous_engine344_cannot_be_packaged(self):
         self.assertGreater(checked, 0)
 
     def test_immediately_previous_engine345_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.345',
+        old = {'0.183.365': '0.183.345',
                ENGINE_SHA: '780263c4a884527fa80a28b998ad4bda88b9ad6002a687f9f074602ecad46e62',
                ENGINE_SOURCE: 'd27d4ac73fa05ae43b9ae0c32875780e8a3765b1'}
         checked = 0
@@ -1452,7 +1452,7 @@ def test_immediately_previous_engine345_cannot_be_packaged(self):
         self.assertGreater(checked, 0)
 
     def test_immediately_previous_engine346_cannot_be_packaged(self):
-        old = {'0.183.364': '0.183.346',
+        old = {'0.183.365': '0.183.346',
                ENGINE_SHA: '9deeda5758b7f04135441a203092dd0308d90b65d25037b62ef4f9361d3cf806',
                ENGINE_SOURCE: 'e250e4a17958216c30c1f5d0d31f7b6418a968d5'}
         checked = 0
@@ -1628,7 +1628,7 @@ def test_machine_actual_binary_package_and_retired_boundary_are_verified(self):
     def test_current_readme_status_specific_prose_does_not_block_publication_transition(self):
         common = GATE.split('for current_readme_marker in ', 1)[1].split('; do', 1)[0]
         self.assertNotIn('candidate', common)
-        self.assertNotIn('v1.6.563', common)
+        self.assertNotIn('v1.6.564', common)
         self.assertIn("grep -Fqi 'keep all three named volumes' README.md", GATE)
         status = GATE.split("if grep -Fxq '## Current source candidate' README.md; then", 1)[1]
         candidate, published = status.split("elif grep -Fxq '## Current release' README.md; then", 1)
@@ -1637,7 +1637,7 @@ def test_current_readme_status_specific_prose_does_not_block_publication_transit
         self.assertIn('This candidate is not yet available', candidate)
         self.assertIn('SERVER_CURRENT_PUBLISHED_README_MISSING', published)
         self.assertNotIn('candidate', published)
-        self.assertNotIn('v1.6.563', published)
+        self.assertNotIn('v1.6.564', published)
 
 
 if __name__ == '__main__':
diff --git a/server/Dockerfile.web-compose-release b/server/Dockerfile.web-compose-release
index 189e3f5ec4..3319d6dbdc 100644
--- a/server/Dockerfile.web-compose-release
+++ b/server/Dockerfile.web-compose-release
@@ -90,13 +90,13 @@ ARG PER_HOST_SUBNET_STARTUP_SHA256=f22b41f18d1733c037babed4d2e0474efeedc6017a968
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
 
 ARG WEB_CONSOLE_RELEASE_BASE_URL=https://github.com/PastureStack/web-console/releases/download
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.203
-ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.203.tar.gz
-ARG WEB_CONSOLE_ARTIFACT_SHA256=81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d
-ARG WEB_CONSOLE_COMMIT=d97a8990801a281b519573a48b0db7dd12c9a616
-ARG WEB_CONSOLE_LOCK_SHA256=a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452
-ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.203-runtime.cdx.json
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.204
+ARG WEB_CONSOLE_ARTIFACT=web-console-1.6.204.tar.gz
+ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e
+ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194
+ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32
+ARG WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=web-console-1.6.204-runtime.cdx.json
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa
 ARG CATALOG_SERVICE_RELEASE_BASE_URL=https://github.com/PastureStack/catalog-service/releases/download
 ARG CATALOG_SERVICE_VERSION=0.20.17
 ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
@@ -118,9 +118,9 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
 ARG ORCHESTRATION_ENGINE_RELEASE_BASE_URL=https://github.com/PastureStack/orchestration-engine/releases/download
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.364
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365
 ARG ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047
 ARG COMPOSE_EXECUTOR_RELEASE_BASE_URL=https://github.com/PastureStack/compose-cli/releases/download
 ARG COMPOSE_EXECUTOR_VERSION=0.14.40
 ARG COMPOSE_EXECUTOR_ARCHIVE_SHA256=fa7a4127793ef4e8e6ef18d926d74b50046a80dd2097b08878ef576ddfce6732
@@ -709,12 +709,12 @@ ARG PER_HOST_SUBNET_VERSION=0.2.5
 ARG PER_HOST_SUBNET_PRODUCER_COMMIT=e102e0bb38d84b0a9cbf87e5458cf1bc74d01904
 ARG PER_HOST_SUBNET_ARCHIVE_SHA256=7237e83e96a64e7f3de64eb86bff9721c4e879c35cda9e9de1e4cb1ba225f298
 ARG PER_HOST_SUBNET_PROVENANCE_SHA256=afa2db0e0755c6bd3ee28e111937c521a6d84e6d71d563e99202cf4693000eaf
-ARG SERVER_RELEASE_TAG=v1.6.563
+ARG SERVER_RELEASE_TAG=v1.6.564
 ARG API_EXPLORER_RELEASE_TAG=v1.1.20
 ARG API_EXPLORER_ARTIFACT_SHA256=c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb
 ARG API_EXPLORER_COMMIT=a586f0dc0aa50df579049a8d4bf26f04400fdf75
-ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.364
-ARG ORCHESTRATION_ENGINE_VERSION=0.183.364
+ARG ORCHESTRATION_ENGINE_RELEASE_TAG=v0.183.365
+ARG ORCHESTRATION_ENGINE_VERSION=0.183.365
 ARG ENGINE_READONLY_SCHEMA_SHA256=7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233
 ARG ENGINE_RESTRICTED_SCHEMA_SHA256=f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51
 ARG HOST_API_VERSION=0.38.8
@@ -736,11 +736,11 @@ ARG GLIBC_PACKAGE_VERSION=2.43-2ubuntu2.4
 ARG GLIBC_RUNTIME_PACKAGE_VERSION=2.43-2ubuntu2.4+pasturestack.1
 ARG PERL_PACKAGE_VERSION=5.40.1-7ubuntu0.3
 ARG PCRE2_PACKAGE_VERSION=10.46-1build1+pasturestack.1
-ARG WEB_CONSOLE_RELEASE_TAG=1.6.203
-ARG WEB_CONSOLE_ARTIFACT_SHA256=81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d
-ARG WEB_CONSOLE_COMMIT=d97a8990801a281b519573a48b0db7dd12c9a616
-ARG WEB_CONSOLE_LOCK_SHA256=a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452
-ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e
+ARG WEB_CONSOLE_RELEASE_TAG=1.6.204
+ARG WEB_CONSOLE_ARTIFACT_SHA256=8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e
+ARG WEB_CONSOLE_COMMIT=64caa55d0b0768de1633549b54a169ddb62c9194
+ARG WEB_CONSOLE_LOCK_SHA256=bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32
+ARG WEB_CONSOLE_RUNTIME_SBOM_SHA256=195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa
 ARG CATALOG_SERVICE_VERSION=0.20.17
 ARG CATALOG_SERVICE_COMMIT=2f70559e340865eb6243662ed33d8cbc7b1efa90
 ARG CATALOG_SERVICE_ARCHIVE_SHA256=4f83f89763ce325262baf8984782da2c21fd81e3cc22c0a1c76aaa50b2a50f20
@@ -759,8 +759,8 @@ ARG WEBHOOK_AUTOMATION_SERVICE_VERSION=0.10.5
 ARG WEBHOOK_AUTOMATION_SERVICE_COMMIT=4da77ccac464bc7f7cd2020e0659a666a5d1ff7e
 ARG WEBHOOK_AUTOMATION_SERVICE_ARCHIVE_SHA256=f2df8874d5a00a2d5713594609063256164ed624d29a733149d00cb271f0f66b
 ARG WEBHOOK_AUTOMATION_SERVICE_BINARY_SHA256=b98e55db2739ab45119eacc94c8f65cb44371480ebcebec95e5470fd67c72a4c
-ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb
-ARG ORCHESTRATION_ENGINE_COMMIT=e780d1613ab2a14112ba9e14fa55754b4e16ed0b
+ARG ORCHESTRATION_ENGINE_ARTIFACT_SHA256=46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047
+ARG ORCHESTRATION_ENGINE_COMMIT=10e674d32de9c5d6ad63867a1b76d080ac76af48
 ARG HOST_PROVISIONER_VERSION=0.39.10
 ARG HOST_PROVISIONER_COMMIT=d5f6d5c9f4f0599f4bf1bdc9d5d0cca2e2e0c1ba
 ARG HOST_PROVISIONER_ARCHIVE_SHA256=fd8a814c5810746091ba3192a9fd31699e6865a2598654b9bbb55eae90bef661
diff --git a/server/build-api-explorer-patch-image.sh b/server/build-api-explorer-patch-image.sh
index 2155b7f9ab..6a5a715f9f 100755
--- a/server/build-api-explorer-patch-image.sh
+++ b/server/build-api-explorer-patch-image.sh
@@ -14,14 +14,14 @@ if [[ -n "$(git status --porcelain --untracked-files=normal)" ]]; then
 fi
 
 revision=${PASTURESTACK_SERVER_REVISION:-$(git rev-parse HEAD)}
-server_release_tag=${SERVER_RELEASE_TAG:-v1.6.563}
+server_release_tag=${SERVER_RELEASE_TAG:-v1.6.564}
 source_date_epoch=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
 base_image=${BASE_IMAGE:-ghcr.io/pasturestack/server:v1.6.460@sha256:c855af8aea232dacc5bb6df68e2271d482c68b53c43ab0c108ec19118f5ab403}
 orchestration_engine_release_base_url=${ORCHESTRATION_ENGINE_RELEASE_BASE_URL:-https://github.com/PastureStack/orchestration-engine/releases/download}
-orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}
+orchestration_engine_release_tag=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}
 orchestration_engine_artifact=${ORCHESTRATION_ENGINE_ARTIFACT:-cattle.jar}
-orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-279ae58c5ec0189df09e57fb9a9014b633a5323c884d49e63036046c6f8b15bb}
-orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-e780d1613ab2a14112ba9e14fa55754b4e16ed0b}
+orchestration_engine_artifact_sha256=${ORCHESTRATION_ENGINE_ARTIFACT_SHA256:-46df4e5bc38da7f6eae1d9a8d68e1d45cfc87c9cc63a405973c3a057b6b03047}
+orchestration_engine_commit=${ORCHESTRATION_ENGINE_COMMIT:-10e674d32de9c5d6ad63867a1b76d080ac76af48}
 orchestration_engine_version=${orchestration_engine_release_tag#v}
 engine_readonly_schema_sha256=${ENGINE_READONLY_SCHEMA_SHA256:-7f274219e8dd9c6d750a408a6edec1448b564f4b16ba2204c425c5b45cec2233}
 engine_restricted_schema_sha256=${ENGINE_RESTRICTED_SCHEMA_SHA256:-f854ba99260f29e324ab7446a8592996946038920ac9bcf17689d98d1ebc5e51}
@@ -63,13 +63,13 @@ api_explorer_artifact=${API_EXPLORER_ARTIFACT:-api-explorer-1.1.20.tar.gz}
 api_explorer_artifact_sha256=${API_EXPLORER_ARTIFACT_SHA256:-c989ee12a518f6d9d2b23b1f17f48d781aacf6ec31fb65291dd7de9b1661badb}
 api_explorer_commit=${API_EXPLORER_COMMIT:-a586f0dc0aa50df579049a8d4bf26f04400fdf75}
 web_console_release_base_url=${WEB_CONSOLE_RELEASE_BASE_URL:-https://github.com/PastureStack/web-console/releases/download}
-web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.203}
-web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.203.tar.gz}
-web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-81e2e81becb2a006f0a753d781d7ec0383a908081c10864f451e8372b246b59d}
-web_console_commit=${WEB_CONSOLE_COMMIT:-d97a8990801a281b519573a48b0db7dd12c9a616}
-web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-a0dfad456f43949e8c7c707197a0d73c2bb54b1a2a6d0ce763db1e3be7038452}
+web_console_release_tag=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}
+web_console_artifact=${WEB_CONSOLE_ARTIFACT:-web-console-1.6.204.tar.gz}
+web_console_artifact_sha256=${WEB_CONSOLE_ARTIFACT_SHA256:-8a8280c201cf59f2d1e6dbf648c5ddd14dd3129b5d738ce7af37d2c1b9738f4e}
+web_console_commit=${WEB_CONSOLE_COMMIT:-64caa55d0b0768de1633549b54a169ddb62c9194}
+web_console_lock_sha256=${WEB_CONSOLE_LOCK_SHA256:-bef45a7e181b5630c71c255efa96728bcf5efa5c044a1e931462bdd7fb207d32}
 web_console_runtime_sbom_artifact=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${web_console_release_tag}-runtime.cdx.json}
-web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-a34c07e7c6289a72174ddf5be4e83d1ccc8db0ad5fea07264f0b623eb77f013e}
+web_console_runtime_sbom_sha256=${WEB_CONSOLE_RUNTIME_SBOM_SHA256:-195e7be0cd8f936b33c4ccd07a39e1e72db9e9cb38095e41608c36ba3b9e7faa}
 catalog_service_release_base_url=${CATALOG_SERVICE_RELEASE_BASE_URL:-https://github.com/PastureStack/catalog-service/releases/download}
 catalog_service_version=${CATALOG_SERVICE_VERSION:-0.20.17}
 catalog_service_commit=${CATALOG_SERVICE_COMMIT:-2f70559e340865eb6243662ed33d8cbc7b1efa90}
@@ -130,7 +130,7 @@ usage_telemetry_agent_archive_sha256=${USAGE_TELEMETRY_AGENT_ARCHIVE_SHA256:-6d4
 usage_telemetry_agent_binary_sha256=${USAGE_TELEMETRY_AGENT_BINARY_SHA256:-90ed65f689c91801abd0cf482211c96a01e7c63ef695e4faecdf4713eff730be}
 supported_docker_range='~v1.12.3 || ~v1.13.0 || ~v17.03.0 || ~v17.06.0 || ~v17.09.0 || ~v17.12.0 || ~v18.03.0 || ~v18.06.0 || ~v18.09.0 || ~v19.03.2 || v24.0.9 || >=v29.4.1 <=v29.7.2 || v29.8.0'
 newest_docker_version=v29.8.0
-image=${IMAGE:-pasturestack-validation/server:v1.6.563}
+image=${IMAGE:-pasturestack-validation/server:v1.6.564}
 build_options=()
 
 [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
diff --git a/server/build-component-candidate.sh b/server/build-component-candidate.sh
index 273148ef62..2423b6531c 100755
--- a/server/build-component-candidate.sh
+++ b/server/build-component-candidate.sh
@@ -18,10 +18,10 @@ for name in "${required[@]}"; do
     case "$name" in *_COMMIT) [[ ${!name} =~ ^[0-9a-f]{40}$ ]] ;; *) [[ ${!name} =~ ^[0-9a-f]{64}$ ]] ;; esac
     export "$name"
 done
-export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.563}
-export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.364}
+export SERVER_RELEASE_TAG=${SERVER_RELEASE_TAG:-v1.6.564}
+export ORCHESTRATION_ENGINE_RELEASE_TAG=${ORCHESTRATION_ENGINE_RELEASE_TAG:-v0.183.365}
 export ORCHESTRATION_ENGINE_ARTIFACT=cattle.jar
-export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.203}
+export WEB_CONSOLE_RELEASE_TAG=${WEB_CONSOLE_RELEASE_TAG:-1.6.204}
 export WEB_CONSOLE_ARTIFACT="web-console-${WEB_CONSOLE_RELEASE_TAG}.tar.gz"
 export WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT=${WEB_CONSOLE_RUNTIME_SBOM_ARTIFACT:-web-console-${WEB_CONSOLE_RELEASE_TAG}-runtime.cdx.json}
 export WEBSOCKET_PROXY_VERSION=${WEBSOCKET_PROXY_VERSION:-0.23.18}
diff --git a/server/security/openvex.json b/server/security/openvex.json
index 9271c83f2f..f79b129cb4 100644
--- a/server/security/openvex.json
+++ b/server/security/openvex.json
@@ -1,9 +1,9 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.563",
+  "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.564",
   "author": "PastureStack Security",
-  "timestamp": "2026-11-01T07:31:13Z",
-  "version": 76,
+  "timestamp": "2026-11-01T14:33:29Z",
+  "version": 77,
   "statements": [
     {
       "vulnerability": {
diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json
index eb448c38a9..8c06ba1182 100644
--- a/server/security/vendor-pending.json
+++ b/server/security/vendor-pending.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "release": "v1.6.563",
+  "release": "v1.6.564",
   "generatedAt": "2026-10-29T09:57:33.809116+00:00",
   "policy": {
     "allowedSeverities": [